Technical information
Malicious functions:
Sends SMS messages:
- 12114: 苏州易N支付##########
Network activity:
Connecting to:
- c####.####.com
- t####.####.com
- a####.####.com
- d####.####.com
HTTP GET requests:
- c####.####.com/user?ui=####&avc=####&da=####&b=####&c=####&n=####&l=####...
- t####.####.com/request_act?ap=####
- t####.####.com/request_mnp?ap=####
- c####.####.com/app_settings?ui=####&avc=####&da=####&b=####&c=####&n=###...
- c####.####.com/get_flow?ui=####&avc=####&da=####&product_id=####&b=####&...
HTTP POST requests:
- d####.####.com/wmserver/WMUpdate
- a####.####.com/app_logs
- d####.####.com/wmapp/WMAppInit
Modified file system:
Creates the following files:
- /data/data/####/files/cmn_game_config
- /data/anr/traces.txt
- /data/data/####/app_cmnraw/sdk_pay_union
- /data/data/####/app_cmnraw/sdk_pay_general
- /data/data/####/shared_prefs/com.upay.billing.saveddata.Main.xml
- /data/data/####/app_cmnraw/config.xml
- /sdcard/.sys_res
- /data/data/####/app_cmnraw/sdk_pay_cmcc
- /data/data/####/shared_prefs/Wimipay_System.xml
- /data/data/####/shared_prefs/upay_pay.xml
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml
- /data/data/####/shared_prefs/epay_share.xml
- /data/data/####/app_cmninfo/cmnupdate
- /data/data/####/shared_prefs/upay_pay.xml.bak
- /data/data/####/app_cmnraw/sdk_base
- /data/data/####/databases/juLTXpm1ZKA
- /data/data/####/app_cmninfo/66da30dd7287a5e70f2f6c326c7342f4
- /data/data/####/shared_prefs/cmnpay.xml
- /data/data/####/shared_prefs/util_preference.xml
- /data/data/####/databases/juLTXpm1ZKA-journal
- /data/data/####/databases/webview.db-journal
- /data/data/####/databases/lepeng.db-journal
- /data/data/####/shared_prefs/####.xml
- /data/data/####/shared_prefs/quda_id.xml
- /data/data/####/app_cmnraw/sdk_pay_others
- /data/data/####/shared_prefs/zhangpay_share.xml.bak
- /data/data/####/app_cmnraw/sdk_pay_base
- /data/data/####/files/C1FB581D0EB004904A774F2661711D66.jar
- /sdcard/Download/mmsapp.apk
- /data/data/####/shared_prefs/epay_share.xml.bak
- /data/data/####/shared_prefs/PZpXdH5d7i8.xml
- /data/data/####/shared_prefs/zhangpay_share.xml
- /data/data/####/app_cmnraw/sdk_base_res
Miscellaneous:
Executes next shell scripts:
- busybox ifconfig
- /system/bin/dexopt --dex 27 83 40 45628 /data/data/####/app_cmnraw/sdk_base 1191536716 1638022389 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/frame
- /system/bin/dexopt --dex 27 88 40 156500 /data/data/####/app_cmnraw/sdk_pay_union 1191536733 -1948071270 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewor
- /system/bin/dexopt --dex 27 86 40 53708 /data/data/####/app_cmnraw/sdk_pay_general 1191536723 -1130706190 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewo
- /system/bin/dexopt --dex 27 78 40 42192 /data/data/####/files/C1FB581D0EB004904A774F2661711D66.jar 1187742490 -1511260134 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar
- /system/bin/dexopt --dex 27 84 40 52688 /data/data/####/app_cmnraw/sdk_pay_base 1191536720 -875287986 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/f
- /system/bin/dexopt --dex 27 87 40 6760 /data/data/####/app_cmnraw/sdk_pay_others 1191536728 294064774 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/f
- /system/bin/dexopt --dex 27 85 40 65424 /data/data/####/app_cmnraw/sdk_pay_cmcc 1191536727 1871425434 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/f
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
